Log determination device, log determination method, log determination program, and log determination system

Abstract

A log determination device comprises a log acquisition unit that is configured to acquire a security log generated upon detecting an abnormality in an electronic control system, and a false positive log determination unit that is configured to determine, based on a frequency of generation of the security log, whether or not the detected security log is a false positive log, and to output a determination result, wherein the false positive log is the security log generated by detecting the abnormality caused not by the electronic control system being attacked.

What is claimed is: 
     
         1 . A log determination device comprising:
 a log acquisition unit that is configured to acquire a security log generated upon detecting an abnormality in an electronic control system; and   a false positive log determination unit that is configured to determine, based on a frequency of generation of the security log, whether or not the detected security log is a false positive log, and to output a determination result, wherein the false positive log is the security log generated by detecting the abnormality caused not by the electronic control system being attacked.   
     
     
         2 . The log determination device according to  claim 1 , further comprising:
 a storage that is configured to store a reference frequency serving as a reference for determining whether the security log is a false positive log,   wherein   in a case where the frequency is lower than the reference frequency, the false positive log determination unit determines that the security log is a false positive log.   
     
     
         3 . The log determination device according to  claim 2 , further comprising:
 an erroneous operation frequency information acquisition unit that is configured to acquire an erroneous operation frequency information indicating a frequency of an erroneous operation by a user of the electronic control system,   wherein   the erroneous operation frequency information acquisition unit acquire the erroneous operation frequency information in a case where the security log is generated by detecting an abnormality caused by the erroneous operation by the user, and   the reference frequency is updated based on the erroneous operation frequency information.   
     
     
         4 . The log determination device according to  claim 1 , wherein:
 the security log includes an event type information indicating an event related to an abnormality detected in the electronic control system,   the log determination device further comprising,   a storage that is configured to store an erroneous operation event type information indicating an event related to an abnormality that may be caused by an erroneous operation by a user of the electronic control system among the event type information,   wherein:   in a case where the event type information in the security log is same as the erroneous operation event type information, the false positive log determination unit determines whether the security log is the false positive log.   
     
     
         5 . The log determination device according to  claim 1 , wherein:
 the security log includes an event type information indicating an event related to an abnormality detected in the electronic control system and a device type information indicating an electronic control unit that detects the abnormality among a plurality of electronic control units that constitutes the electronic control system,   common security logs are security logs to which the event type information and the device type information are common; and   the false positive log determination unit determines whether the common security logs are false positive logs, based on a frequency of generation of the common security logs among security logs.   
     
     
         6 . The log determination device according to  claim 1 , wherein:
 the log acquisition unit acquires a first security log, which is the security log, and a second security log that is a security log indicating success of a certain event in the electronic control system; and   the false positive log determination unit determines whether or not the first security log is the false positive log, based on a frequency of generation of the first security log before a time when the second security log has been generated.   
     
     
         7 . The log determination device according to  claim 6 , wherein:
 the false positive log determination unit does not determine that the first security log generated during a predetermined period prior to a time when the second security log is generated is the false positive log.   
     
     
         8 . The log determination device according to  claim 1 , further comprising:
 a false positive information assignment unit that is configured to add a false positive information identifying the false positive log to the security log based on the determination result; and   a transmission unit that is configured to transmit the security log to which the false positive information is added.   
     
     
         9 . The log determination device according to  claim 1 , wherein:
 the electronic control system is mounted on a movable object, and   the log determination device is provided outside the movable object.   
     
     
         10 . The log determination device according to  claim 1 , wherein:
 the electronic control system and the log determination device are mounted on a movable object.   
     
     
         11 . A log determination method executable by a log determination device, comprising:
 acquiring a security log generated upon detecting an abnormality in an electronic control system;   determining, based on a frequency of generation of the security log, whether or not the detected security log is a false positive log; and   outputting a determination result,   wherein   the false positive log is the security log generated by detecting the abnormality caused not by the electronic control system being attacked.   
     
     
         12 . A non-transitory computer-readable storage medium storing a log determination program executable by a log determination device, the program comprising instructions of:
 acquiring a security log generated upon detecting an abnormality in an electronic control system;   determining, based on a frequency of generation of the security log, whether or not the detected security log is a false positive log; and   outputting a determination result,   wherein   the false positive log is the security log generated by detecting the abnormality caused not by the electronic control system being attacked.   
     
     
         13 . A log determination system comprising:
 an electronic control system; and   a log determination device,   wherein:   the electronic control system includes
 a log generation unit that is configured to generate a security log in a case where an abnormality is detected in the electronic control system, and 
 a log transmission unit that is configured to transmit the security log to the log determination device; and 
   the log determination device includes
 a log acquisition unit that is configured to acquire the security log transmitted from the log transmission unit, and 
 a false positive log determination unit that is configured to determine, based on a frequency of generation of the security log, whether or not the detected security log is a false positive log, and to output a determination result, wherein the false positive log is the security log generated by detecting the abnormality caused not by the electronic control system being attacked.